Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have this file I use to set my username and password before exporting the value.

#!/bin/bash
echo -n "User:";
read user
echo -n "Password:";
read -s password

export http_proxy=http://$user:$password@$domain:$portnum

if curl -silent http://www.google.com | grep authentication_failed;
then
        echo NO CONNECT
        unset http_proxy
else
        echo OK
fi

in history, printenv, and export -p I'm able to see the value that I have set

furthermore, I'd like an encrypted form of my password inside $password, versus that value containing my password verbatim.

I'm familiar with using openssh to salt passwords, or printing hash using perl's crypt(), but for my purpose, I cannot see it's usage? any tips will be appreciated?

share|improve this question

migrated from serverfault.com Apr 3 at 7:00

This question came from our site for professional system and network administrators.

    
crypt is a one way function known as a hash. If you hash your password that you will be unable to retrieve the plaintext form. This is so that you can verify someone's login with storing their password in plaintext. It will not help you in this situation. You need to look at different forms of encryption such as RSA which being a two function which will let you retrieve the data. –  Jacob Apr 2 at 18:55
    
What exactly are you trying to do here? Most applications that use http_proxy do not support any form of encryption of the credentials, if that is what you are asking. So you could certainly encrypt it, but nothing would be able to use it. –  Zoredache Apr 2 at 20:47
    
There's not any need to encrypt the contents of an environment variable. The reason you can see them is that your user account has the same privileges. Try logging into a different account. You won't be able to see them in /proc/PID/environ. But you should make sure that the permissions on your script are restrictive, such as 0700, so that others aren't able to read its contents. –  Dennis Williamson Apr 3 at 1:46

2 Answers 2

up vote 3 down vote accepted

I am unable to reproduce the issue you mentioned with password showing up in the output from the history command.

The password showing up in the output from printenv and export -p is working as intended. Those commands display the environment variables, and that's where you put the http_proxy string.

The environment variables are automatically inherited by child processes, but not by any other processes. I don't see why you think that is a major concern, as it is only visible to processes within the same security domain.

But you could stop putting it in an environment variable and instead use normal shell variables. Then it would not be inherited by child processes. Since you probably want curl to have access to the environment variable, then you could pass the environment variable to just that one command and not all the other commands.

#!/bin/bash
echo -n "User:";
read user
echo -n "Password:";
read -s password

proxy="http://$user:$password@$domain:$portnum"

if http_proxy="$proxy" curl -silent http://www.google.com | grep authentication_failed;
then
    echo NO CONNECT
else
    echo OK
fi
share|improve this answer

You should rather store the paasword in a secure file only readable by the current user.

Then pipe in that file content or use the mechanisms provided by your target app.

imho curl provides such options itselv.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.